Legal
This policy sets out the principles that govern any research use of the treatment information in Arcametric, and the conditions that must be met before such use occurs.
It works together with the Privacy Policy and the Data Governance and Use Policy. It is a statement of principles and conditions, not a research protocol and not a claim that any particular study has been approved.
Arcametric exists to preserve clinically meaningful context from practitioner-originated treatment documentation, so that authorized users can support continuity, review, reporting, and appropriately governed learning. This policy applies to any contemplated research use of human treatment information, whether it is contributed as care happens or reconstructed from historical sources.
It applies to Arcametric personnel, participating organizations, practitioners, investigators, sponsors, and approved recipients, under executed agreements. Clinical safety obligations remain with authorized care providers and study teams. The software is not the responsible clinical safety team.
Documenting care is not the same as authorizing research. Routine treatment documentation does not, on its own, permit use in a study, a registry, a training dataset, or a commercial dataset. Each proposed research use requires its own documented determination of authority and review.
Research use must not exceed the permissions and expectations lawfully set for the underlying information. Respect each person's autonomy and dignity, honor withdrawal rights where they apply, and explain potential future use plainly.
Treatment documentation created in the course of care does not by itself authorize an observational study, a registry, a training dataset, or a commercial dataset. Each use is decided and documented on its own.
Keep direct identifiers and the local identity-to-reference link outside standard research exports unless an authorized protocol requires otherwise. Treat coded records as potentially re-identifiable, and test indirect identifiers, event dates, small groups, free text, and outside linkability before any extraction or sharing.
Require a defined data controller or custodian, a named permitted recipient, a stated purpose, least-privilege access, recipient authentication, data-use conditions, and clear accountability before information is extracted or shared. Using the software transfers no ownership or research rights by default.
Preserve source, author, the difference between when something happened and when it was entered, later changes, qualifications, and what is missing. Distinguish observed events, patient report, practitioner judgment, imported information, and derived calculations. Never backfill unobserved exposures, safety events, or outcomes.
Account for selection bias, gender-specific and reproductive-health variables, trauma-affected and veteran populations, group differences, cultural context, missing follow-up, and statistical uncertainty. Do not present observational associations as causal effects.
Account for altered-state vulnerability, consent boundaries, supportive-touch and coercion risks, distress, and adverse-event escalation. Protect participant confidentiality throughout.
Document funding sources, sponsor influence, any compensation, conflicts of interest, proposed secondary commercial use, and publication rights. Financial incentives must never encourage fabrication, selective capture, or the withholding of unfavorable outcomes.
Use role-scoped access, auditability, encrypted transport and storage, retention and deletion rules, incident response, risk-based release controls, and third-party diligence as applicable. Specific technical assurances rest on documented verification.
Restrict use to approved questions and recipients. Prohibit unauthorized re-identification, onward transfer, and attempts to identify patients or providers. Report limitations and negative, null, or harmful findings, subject to privacy and safety obligations.
No identifiable or potentially re-identifiable treatment information leaves its authorized custody for research until the following are documented and approved by the appropriate parties.
A named study question, a data dictionary, the source populations, the collection plan, inclusion and exclusion rules, the retention period, the intended analysis, and the planned recipients.
The applicable consent or other lawful basis, the information given to participants, the permitted secondary use, how withdrawal and erasure are handled, and any restrictions that travel with the data.
A decision from an institutional research ethics committee, or a documented determination that such review is not required, as applicable to the study and its jurisdictions.
An analysis of controller and processor roles, where relevant; the responsibilities of the provider, institution, sponsor, and investigator; and the appropriate executed agreements.
A data-flow description, a re-identification assessment, review of free text and timestamps, small-group suppression rules, the minimum necessary variables, and a cross-border transfer assessment.
Verified access controls, encryption and key handling, logs, a subprocessor inventory, vulnerability and backup posture, breach handling, and named escalation owners.
Adverse-event definitions, observation windows, a plan for missing data, a responsible clinician or principal investigator for escalation, provenance and correction methods, and a quality-control and analysis plan.
Arcametric names an internal owner for this policy and a security-incident contact. Each participating organization names a data custodian, a research lead or principal investigator, and a clinical-safety lead.
For every research use, the parties record the authorization date, the agreed scope, the versioned extract and data dictionary, the recipients, the disclosures, any revocations, confirmation of retention and destruction, and incident escalation contacts. Any material change in purpose, data categories, recipients, jurisdictions, or risk is reassessed before the use continues.
This policy draws on established research-ethics and data-protection frameworks, including the World Medical Association Declaration of Helsinki, the CIOMS International Ethical Guidelines for Health-Related Research Involving Humans, the United States National Institutes of Health best practices for protecting participant privacy in data sharing, and recognized guidance on the de-identification and pseudonymization of health information.
Arcametric maintains this policy under version control. Its effective date is recorded when the policy is adopted. We may update it as our practices and obligations develop; when we make a material change we will publish the new version and raise the version number.